diff options
author | Dan Carpenter | 2011-11-07 18:44:12 +0100 |
---|---|---|
committer | Mauro Carvalho Chehab | 2011-11-24 13:27:47 +0100 |
commit | e469183541ac108fbc9bcf8e73c2061f049be620 (patch) | |
tree | eeb14c68f8098e0cb113f1bdad680182272df09a /drivers/media/video/mt9t112.c | |
parent | [media] ir-rc6-decoder: Support RC6-6A variable length data (diff) | |
download | kernel-qcow2-linux-e469183541ac108fbc9bcf8e73c2061f049be620.tar.gz kernel-qcow2-linux-e469183541ac108fbc9bcf8e73c2061f049be620.tar.xz kernel-qcow2-linux-e469183541ac108fbc9bcf8e73c2061f049be620.zip |
[media] V4L: mt9t112: use after free in mt9t112_probe()
priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/mt9t112.c')
-rw-r--r-- | drivers/media/video/mt9t112.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c index 32114a3c0ca7..7b34b11daf24 100644 --- a/drivers/media/video/mt9t112.c +++ b/drivers/media/video/mt9t112.c @@ -1083,8 +1083,10 @@ static int mt9t112_probe(struct i2c_client *client, v4l2_i2c_subdev_init(&priv->subdev, client, &mt9t112_subdev_ops); ret = mt9t112_camera_probe(client); - if (ret) + if (ret) { kfree(priv); + return ret; + } /* Cannot fail: using the default supported pixel code */ mt9t112_set_params(priv, &rect, V4L2_MBUS_FMT_UYVY8_2X8); |